Recently I have been trying to reverse engineer an IoT malware called NyaDrop using IDA. There I came across this mysterious assignment a few times.
addiu $zero, 0xA
as well as move $at, $at
Both instructions seem to be just redundant but I feel like they are there for a reason. Does anyone have any idea what that reason is? My guess is that is trying to avoid an emulated MIPS perhaps? Because it would error on an emulated MIPS but will just be discarded in a real one. Not sure, however.
Here is a snippet from the disassembly of nyaDrop that is particularly confusing.
addiu $zero, 0xA
move $at, $at
move $at, $at
//end of malware
addiu $zero, 0xA
. – reallyunknown Apr 25 '20 at 21:04